CNN/Money 
CNNMoney.com
Commentary > Wastler's Wanderings
graphic
Vandalism's evolution on the Net
Another worm exposes a gang mentality among virus makers and a worrying transformation.
May 4, 2004: 4:01 PM EDT

Sign up for the Eyeopener e-mail newsletter

Don't you wish virus writers would discover girls and beer? Life would be better, for them and us. Unfortunately, they take out their adolescent urges in cyberspace, and the rest of us have to suffer.

Witness the "Sasser" worm making the rounds this week.

This nasty little bug slides into unprotected computers and proceeds to restart them over and over. No files eaten or drives trashed ... just irritation for irritation's sake.

As of mid-week, there were four variants of the worm and estimates of 500,000 to 1 million infected computers. Computer problems were reported at several companies, though few were willing to admit the glitches were Sasser-related (other companies would snicker, you see, and other degenerates would think them easy marks).

Want further evidence the Sasser bug was thought up by a kid in dire need of a spanking? There's a follow up e-mail professing to be a Sasser-fixer. Those dumb enough to believe this and open the attachment are hit with Netsky-AC -- the 28th variant of an e-mail worm that opens up your computer to hijacking.

In that NetSky worm is this charming little message:

"Hey, av firms, do you know that we have programmed the sasser virus?!?. Yeah thats true! Why do you have named it sasser? A Tip: Compare the FTP-Server code with the one from Skynet.V!!! LooL! We are the Skynet..."

A translation:

"Attention anti-virus companies ... we, the authors of this virus (NetSky-AC), are also the authors of Sasser. Honest. And we're curious: why do you call the virus 'Sasser'? Anyway, to prove the connection check out how similar the code in Sasser is to a virus we previously wrote. We are laughing quite a bit. And we like to be called Skynet."

Boasting is not uncommon among virus writers.

"Yes, they take credit for it," said Carole Theriault, a security consultant with Sophos, an anti-virus outfit in Europe. Apparently, a sort of gang mentality is building up between virus camps, she explained. "They try to impress one another and outdo one another."

So now we've gone from simple adolescent vandalism to gang behavior (cue "West Side Story" music ... The Jets are going to have their way tonight ...)

Right now the typical profile for a virus writer is a 16 to 24 year-old male. But profiles aren't static.

"I've found in various investigations that it ranges among ages, sexes, religions," said Greg Fowler, of the FBI's Northwest Cyber Crime taskforce.

Indeed, just two months ago Belgium police arrested a 19-year-old female virus writer that went by the handle "Gigabyte."

YOUR E-MAIL ALERTS
Wastler's Wanderings
Computer Worm
Sasser

Well, we aren't seeing a set profile, but we are seeing a transformation. A bratty, destructive child grows into a delinquent. And a delinquent grows into a criminal. Dare I say wiseguy?

"We are already seeing a transformation, where virus writing is getting more sinister and turning toward monetary gain," said Theriault.

It won't be long before this cyber vandalism grows into outright thievery, joining the wave of cyber fraud we are seeing elsewhere. Recognize it and prepare.  Top of page


Allen Wastler is Managing Editor of CNN/Money and a commentator for CNNfn.




  More on COMMENTARY
The overcast economy: Get used to it
Time for Tim to act tough
QQQuestionable anniversary for Nasdaq
  TODAY'S TOP STORIES
Aging baby boomers = nursing shortage
Stocks near 14-month highs
Another big leap for home sales




graphic graphic

© 2009 Cable News Network. A Time Warner Company. All Rights Reserved. Terms under which this service is provided to you. Privacy Policy. Advertising Practices.
Copyright © 2009 BigCharts.com Inc. All rights reserved. Please see our Terms of Use.
MarketWatch, the MarketWatch logo, and BigCharts are registered trademarks of MarketWatch, Inc.
Intraday data provided by Interactive Data Real-Time Services and subject to the Terms of Use.
Intraday data is at least 20-minutes delayed. All times are ET.
Historical, current end-of-day data, and splits data provided by Interactive Data Pricing and Reference Data.
Fundamental data provided by Morningstar, Inc..
SEC Filings data provided by Edgar Online Inc..
Earnings data provided by FactSet CallStreet, LLC.